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FOREWORD 


This technical note documents experience gained in the area of spacecraft crew 
station design and operations during the Apollo Program. Emphasis is given to the 
time period ranging from early 1964 up to, and including, the Apollo 11 lunar-landing 
mission of July 1969 — an era that covers three important phases of the Apollo Pro- 
gram: the design phase, hardware construction, and mission operations. 

This technical note consists of five volumes. Volume I, "Crew Station Design 
and Development, " gives an overview of the total crew station integration task. 
Volumes II, III, IV, and V are specialized volumes, each of which is devoted to a basic 
functional area within the Apollo crew station. The subject of each volume is indicated 
by its title, as follows. 

Volume II, "Crew Station Displays and Controls" 

Volume III, "Spacecraft Hand Controller Development" 

Volume IV, "Stowage and the Support Team Concept" 

Volume V, "Lighting Considerations" 


Louis D. Allen 

Lyndon B. Johnson Space Center 
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APOLLO EXPERIENCE REPORT 

CREW STATION INTEGRATION: 

VOLUME II - CREW STATION DISPLAYS AND CONTROLS 

By William A. Langdoc and Dale A. Nussman 
Lyndon B. Johnson Space Center 

SUMMARY 


The Apollo displays and controls system includes such devices as meters and 
switches that enable the flight crew to monitor and control the operations of the space- 
craft. The Apollo displays and controls system was based on design practices and 
operation principles established during previous aircraft and spacecraft programs. 
Except for several unique devices developed for special applications, displays and 
controls system components were conventional in design and operation. The design 
development of the displays and controls system was evolutionary, and most design 
changes resulted from alterations in the interfacing subsystems or from the identifica- 
tion of new requirements. The Apollo displays and controls performed well under all 
mission conditions and met all design objectives. 


INTRODUCTION 


The discussion in this volume primarily pertains to the Apollo command module 
(CM) and lunar module (LM) displays and controls (D&C) requirements, configurations, 
and operations, as opposed to the detailed design and development of D&C hardware. 
Throughout the development of the Apollo spacecraft, the engineering responsibility 
for the D&C subsystem was essentially divided into two parts: requirements and 
hardware. 

Requirements responsibility consisted of the definition and implementation of 
man/machine interface requirements; for example, control deflection characteristics, 
display formats, and integration of controls and displayed information. A flight-crew- 
support organization had the primary responsibility in this area. Hardware responsi- 
bility consisted of detailed component design, qualification testing, and test checkout. 
An engineering and development organization was responsible for this area. 

Requirements responsibility for the portions of the Apollo D&C subsystems from 
the "panel out" is the area emphasized in this report. Because the two efforts 
(requirements and hardware) cannot be separated entirely, some hardware discussion 



is included for clarity and completeness. No attempt is made to document in detail 
the D&C component designs, development histories, or qualification tests; however, 
such information may be found in the other volumes of this series. This brief docu- 
mentation of what the Apollo D&C configuration was, how it was developed and operated, 
and how it could have been improved is intended to benefit others faced with similar 
problems. 

As an aid to the reader, where necessary the original units of measure have been 
converted to the equivalent value in the Systeme International d'Unites (SI). The SI 
units are written first, and the original units are written parenthetically thereafter. 


DESIGN PHILOSOPHIES 


An enumeration of the philosophies under which the displays and controls were 
developed precedes the description of the CM and the LM D&C and the discussion of 
their design and operation. The Apollo D&C requirements were based mostly on pre- 
vious spacecraft and aircraft experience and were refined, modified, and finalized as 
the design evolved. The following were the most fundamental and influential require- 
ments levied on the D&C systems. 

1. No single display or control failure would jeopardize the safety of the flight 
crew or be cause for an abort. 

2. The D&C design would allow a single crewman to fly either the CM or the LM 
to safety (i.e. , the LM to lunar orbit or the CM to Earth). 

3. Displays and controls would be provided to enable the flight crew to control 
the vehicle and to manage the subsystems during all mission phases. 

4. Information would be presented so as to permit rapid assessment of critical 
system status without resorting to extensive troubleshooting procedures to identify 
malfunctions . 

5. Normal subsystem operation would not require continuous monitoring or con- 
trol by the crewmen. 

6. Displays and controls that were susceptible to damage or to inadvertent 
actuation as a result of normal crew operations would be guarded appropriately. 

7. Existing proven design concepts would be used as much as practical. 

8. The D&C of the CM and the LM would be standardized to improve crew effi- 
ciency by the elimination of conflicting designs. 

9. All D&C would be designed for satisfactory operation by a pressure- suited 
crewman, and all D&C used during accelerated flight would be designed for operation 
by a pressure- suited, fully restrained crewman. 
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10. Primary command would be onboard the spacecraft. The capability would 
exist to perform the mission without dependence on ground-based information; how- 
ever, the use of ground-based information to increase reliability, accuracy, or per- 
formance would not be precluded. 

11. Automatic systems would be used to obtain precision, to speed response, or 
to relieve the crewmen of tedious tasks; but all automatic control modes would have a 
manual backup. 

12. Initiation of any abort would be onboard, and the crewmen would have the 
primary responsibility. 

13. Annunciator displays would be provided to indicate critical malfunctions of 
onboard systems. Activation of these displays would be announced to the crewmen by 
both visible and audible master alarm signals. 

14. Displays and controls would be furnished to provide the LM with the capa- 
bility for a visual or an instrument landing. 

15. Crew launch- abort initiation would be based on at least two cues. 

Within the aforementioned general philosophies, detailed design practices were 
established. The following practices evolved in the final design. 

1. Time- shared displays would be used whenever the displayed parameters did 
not need to be monitored continuously or concurrently. This approach reduced the 
number of components required, conserved panel space, and facilitated crew opera- 
tions by helping to group related information. 

2. Percentage readouts would be used for quantity displays. Originally, con- 
sumables were to be displayed in volume or mass units, but use of this method would 
have required a mental calculation by the crewman to determine how usage was progres- 
sing. Percentage readouts facilitated a rapid assessment of quantity status. 

3. Fixed-scale, moving-pointer meters would be the preferred and generally 
used type of display. 

4. Status indicators would be used to indicate equipment status where such 
equipment was actuated by inputs from momentary toggle switches. 

5. Where feasible, dual meters of the fixed-scale, moving-pointer type would 
use a single scale that was appropriate for both parameters displayed and that was 
centered between two pointers. 

6. Scale graduations would generally progress by one, five, or two units, in 
that order of preference, or by decimal multiples. 

7. Nonlinear display scales would be avoided. 

8. Nomenclature would describe ”what,” not ’*how.” 
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9. All displays, controls, and panel nomenclature would be integrally lit so as 
to be visible under darkened cabin conditions, such as during star sightings. 

10. Time would be displayed digitally. Analog clocks and timers (similar to an 
aircraft 8-day clock) were originally proposed, but difficulty in reading analog clocks 
and timers rapidly and accurately caused the change to digital clocks. 

11. Display range and readout accuracy would not exceed the needs of the flight 
crew to manage the spacecraft, and display scaling would not be more precise than the 
accuracy of the input signals. 

12. Status displays would indicate equipment response and not merely control 
position. 

13. Flight- control and navigation displays would have * ’fly to" pointers and 
symbols. 

14. Displays associated with a control would be located so as to be unambiguously 
related to the control and visible to the crewmen while in operation. 

15. Related D&C would be grouped to facilitate training and operations. 

16. When operations followed a sequential or logical pattern, the D&C would be 
arranged to facilitate such operations. 

17. When practicable, a positive indication of the loss of display power and sig- 
nal would be provided. 

18. Switches would be provided to deadfaceall crew operational power connectors 
to prevent the necessity for making or breaking any connections while power was applied. 


CONFIGURATION DESCRIPTION 


Although the general configuration of the D&C panels for the Apollo CM and LM 
was based on design practices established for previous aircraft and spacecraft, the 
configurations were, nonetheless, unique in many aspects because of the specialized 
mission involved. The CM was a three-man vehicle designed to be flyable during lunar 
orbit or emergency conditions by a single crewman. Most of the displays and controls 
were located on the main display console (MDC) above the couches. This location per- 
mitted easy monitoring and rapid access. The MDC was designed with the left half 
devoted primarily to flight-control-related D&C and the right half devoted to subsys- 
tems management D&C. Several of the spacecraft systems also had additional controls 
located elsewhere in the cabin. The guidance and navigation (G&N) system displays and 
controls used in conjunction with navigation sightings and inertial platform alinements 
were located in the lower equipment bay (LEB), adjacent to the G&N telescope and 
sextant. Manual controls for the environmental control system (ECS) that did not 
require frequent or time-critical manipulation were located in the left-hand equipment 
bay. Waste management controls and non-time-critical circuit breakers were located 
in the right-hand equipment bay. The general arrangement of the CM crew station is 
shown in figure 1. 
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Combined tunnel hatch 



Figure 1. - The Block II CM crew station arrangement. 


The LM, like the CM, was designed to be flyable in a contingency condition by a 
single crewman. Normal operation, however, required a two-man crew, with the 
commander (CDR) in the left position and the LM pilot (LMP) in the right position. The 
main D&C panels were canted forward and centered between the two crewmen to per- 
mit sharing and easy scanning. An alinement optical telescope between the flight sta- 
tions was provided for navigational operations. The ECS and portable life- support 
system (PLSS) recharge stations were located immediately behind the LMP and the 
CDR, respectively. The general LM crew station arrangement is shown in figure 2. 

A standard approach was used for locating and arranging the D&C within the CM 
and the LM. Flight- control displays and controls, because of their inherent critical 
nature and frequent use, were located in the prime panel areas. The displays and 
controls for all other spacecraft systems were generally grouped by system and located 
according to criticality, frequency of use, crew task sharing, and the most efficient 
use of available panel space. Assignment of D&C to (and sometimes between) particu- 
lar crewmen, in general, was instituted according to standard aerospace practices. 

For example, on the LM, the CDR was provided with the primary flight-critical D&C. 
However, certain items were located for mutual access by the crewmen or were dupli- 
cated at the LMP flight station to implement copilot responsibility. The LMP stations 
also had subsystem-management D&C that reflected the additional flight- engineer 
responsibilities of the LMP. The main panels for the LM and CM are shown in 
figures 3 and 4, respectively. The ways in which the design philosophies were imple- 
mented and the configuration that finally evolved can be seen in some detail in these 
figures. 
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Figure 3.- The LM main panels. 

The D&C components used on the Apollo spacecraft were, like the overall D&C 
systems configurations, similar to those used on aircraft and previous spacecraft. 
Unique devices, such as the entry monitor system (EMS), were developed for special 
applications; but, generally, the components were conventional in design and opera- 
tions. The component variations that did exist were generally attributable to the addi- 
tion of operational requirements, such as the use of controls while the crewman was in 
a pressurized suit or under zero-g conditions or the need to monitor and control during 
high-g or vibration conditions (or both), and to the addition of more stringent qualifica- 
tion requirements to achieve very high reliability under severe environmental 
conditions. 


Controls 

The control devices used in the Apollo spacecraft included toggle switches, push- 
button switches, rotary switches, continuously variable controls, and circuit breakers. 

Toggle switches . - Toggle switches were the most frequently used control devices. 
The chief factors favoring their selection were that toggle switches generally required 
less panel space, gave a positive status indication (except for momentary switches), and 
were easy to actuate under a variety of flight conditions. Two- and three-position 
switches with various combinations of maintaining and momentary positions were used 
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to actuate or select operating conditions or components. A four-position (up/down, 
left/right) momentary switch was also used on the LM for manual positioning of the 
rendezvous radar antenna. Momentary positions were used to initiate a specific action 
requiring current for only a short time, such as jettisoning the launch-escape tower or 
operating a latching relay or valve. 

Maintaining switches were used for most applications. An inherent advantage of 
the maintaining- type switch is a visual indication of switch position and, therefore, of 
system and vehicle configuration. The momentary-type switch, in which the handle is 
spring-loaded to return to another position, does not give such inherent status indica- 
tion. For most functions initiated with momentary switches, such as opening a latching 
valve, some type of adjacent status indicator was necessary. This requirement for a 
status indicator to be used with most momentary toggle switches meant that an addi- 
tional component and more panel space would be required than if a maintaining-type 
toggle switch were used. Status indicators provided with momentary switches, 
however, had the added advantage of providing the end-item status of the equipment 
being controlled, whereas a maintaining switch, in itself, gave no such information. 


Most of the toggle switches used on the Apollo vehicles had a wedge-shaped tab 
handle that provided the crewman a large purchase area with which to actuate the 
switch while wearing a pressurized glove. Toggle switches that had locking mecha- 
nisms incorporated into the handle to keep the switch from being thrown inadvertently 
were also used. These lever-lock switches (fig. 5) had large, bat-shaped handles and 
were used extensively on the LM spacecraft. An additional feature of the LM toggle 
switches was a radioluminescent (RL) tip on both regular and lever-lock handles. The 
RL tips enabled quick determination of the switch position even when the cabin flood- 


lights were dimmed. Alternate approaches 
were used to guard and to illuminate CM 
toggle switches. Command module toggle 
switches were recessed within a trough and 
guarded with adjacent wickets (fig. 6). The 
toggle switches were lit by spill lighting 
from the edge of the electroluminescent 
(EL) nomenclature overlay. 

The operating characteristics of the 
toggle switches were approximately 3 to 
44. 5 newtons (10 to 160 ounces) of actu- 
ating force (depending on the number of 
poles), 34° ± 8° of throw for two-position 
switches, and 17° ± 4° of throw for three- 
position switches. The force values were 
acceptable, but a lower value for the upper 
limit of actuating force would have been 
preferable from an operational viewpoint. 
The possibility of increasing the deflection 
for three-position switches should also be 
considered in future designs because many 
of these switches have been mistakenly 
mispositioned or monitored (or both) on 
Apollo missions. 



Figure 5. - Control panel showing 
lever -lock switches. 
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Pushbutton switches . - Pushbutton 
switches were used for applications requiring 
the rapid initiation of a function, for high- 
frequency-of-use situations, and for appli- 
cations requiring a combined control/signal 
device. Pushbutton switches were most 
widely used for applications requiring the 
rapid initiation of a function. In the CM, 
pushbutton switches were used mostly as 
manual backup controls to initiate various 
sequential events during launch and entry; 
in the LM, they were used to back up main 
engine commands and to shut down the 
descent engine on lunar touchdown. Push- 
button switches, in a keyboard format, 
were used to enter data into the guidance 
computers. Master alarm pushbutton/ 
signal lights in both vehicles served to 
indicate caution and warning (C&W) condi- 
tions and to reset the alarm circuitry. 


Figure 6. - Wickets guarding the CM 
toggle switches. 



Square pushbuttons, slightly larger than those normally used in aircraft or in the 
Gemini spacecraft, were used for most applications. The larger size (approximately 
2.03 centimeters (0. 8 inch) on a side) aided actuation and permitted the use of larger 
legends. 

Rectangular master alarm pushbutton lights, approximately 6.5 square centi- 
meters (1 square inch) in area, were used in both the CM and the LM. Pushbutton- 
switch operating characteristics were 3 to 21 newtons (10 to 74 ounces) of actuating 
force and 0. 317 to 1. 5 centimeters (0. 125 to 0. 6 inch) of travel. 

Rotary switches. - Rotary switches were used when four or more detent positions 
were required for discrete functions, or in applications that required many poles or 
high- current capacities. In the latter applications, the design of a rotary switch was 
generally more suitable than the design of a toggle switch. 

Rotary switches were highly advantageous in accomplishing numerous switching 
functions, but this capability in turn increased the criticality of a failure. A mechan- 
ically jammed rotary switch, for example, could inhibit all the switching functions 
normally performed by the control. Therefore, the LM rotary switches were posi- 
tioned in the most critical detent positions before Earth launch; and, in later lunar 
modules, mission- critical rotary switches were replaced with (and by an additional 
number of) toggle switches. 

A standardized rotary control knob (fig. 7) was used in both the Apollo vehicles. 
The knob was equipped with a circular skirt to allow for transillumination of an integral 
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pointer indicium. Actuating forces ranged 
from 8.5 to 85 centimeter-newtons (12 to 
120 inch-ounces). A standard 30° spacing 
between adjacent positions was used for all 
rotary switches. 

Continuously variable controls. - 
Continuously variable controls, such as 
potentiometers, rheostats, and variable 
transformers, were used for functions 
requiring precise control and adjustment 
of system or equipment parameters. Some 
of these functions included the control of 
lighting intensities, audio volume, and 
antenna positioning. Continuously variable 
controls were equipped with thumbwheel 
and rotary-switch-type knobs. Thumb- 
wheels were used predominantly for audio 
controls and knobs for lighting and antenna 
controls. The periphery of thumbwheels 
was marked with integers from one to nine 
for indexing the control. 



Figure 7. - Standardized rotary control 
knobs used in both the LM and 
the CM. 


A slightly different type of rotary control knob was used to operate a stepper 
motor. Because a stepper motor has little inherent friction to maintain it at the set 
position, a device that would hold the control at the selected position was necessary. 
This locking was accomplished by the use of a knob resembling the other rotary con- 
trol knobs but having an internal locking mechanism. Pushing in the top portion of 
the knob unlocked the control and allowed it to be positioned freely. Releasing the 
knob locked the stepper motor in place. 

To operate continuously variable controls with rotary- switch-type knobs required 
a torque of 6 to 25 centimeter-newtons (8 to 36 inch-ounces). Failure to specify a 
lower acceptable limit for rheostat actuating torque in the LM procurement specifica- 
tion resulted in the delivery of several units having torques of less than 1. 4 centimeter- 
newtons (2 inch-ounces). The addition of external friction washers between the control 
knob and the panel compensated for this improper torque value. Thumbwheel controls 
required 1.4 to 4 centimeter-newtons (2 to 6 inch-ounces) to operate. Early LM 
thumbwheels were also delivered with improper torque values. Because requirements 
documentation was misinterpreted, early thumbwheel units having torques of 
14 centimeter-newtons (20 inch-ounces) and greater were delivered; but these units 
were used "as is" in nonflight applications. A standard 300° deflection was imple- 
mented for all continuously variable controls. 

Circuit breakers . - Circuit breakers were used primarily to protect electrical 
circuits. Sometimes, however, circuit breakers were used as control devices; this 
application occurred mostly on the LM, where weight was very critical. In all these 
instances, though, an attempt was made to design the systems so that switching actions 
were limited in number and conducted under a no-load condition. Circuit breakers 
were procedurally used on both vehicles to disable critical circuits during periods 
when they were not required. 
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The circuit breakers used on the Apollo vehicles were the push/pull type and had 
a small, black knob. An aluminum band was displayed when the breaker was open. A 
white band originally used was deleted because the paint flaked and chaffed. Some 
difficulty was encountered in visually monitoring the lower contrast silver-colored 
bands in the lower level lighting environment of the LM. This condition resulted in 
the misconfiguration of certain circuit breakers by the Apollo flight crews. To avoid 
this situation in future programs, crew station lighting simulations should be per- 
formed to verify altered D&C color schemes. 

Circuit breakers were particularly susceptible to inadvertent actuation or 
damage. This susceptibility was especially prevalent on the LM because of the amount 
of crew activity associated with lunar surface operations (e.g. , backpack donning and 
doffing). Therefore, special precautions were taken in both vehicles to protect the 
circuit breakers by recessing the panels (fig. 8) or by providing barrier guards 
(fig. 9) or by both methods. 



Figure 8. - Recessed panel. Figure 9. - Barrier guards. 


All circuit breakers were the M trip free” type currently used on military air- 
craft; that is, a "tripped" breaker could not be manually overridden (closed). 
Nominally, 53. 4 newtons (192 ounces) of force were required to close and 27 newtons 
(96 ounces) to open the circuit breakers. Total travel was approximately 0. 5 centi- 
meter (0. 2 inch). 
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Displays 


Several different types of displays and signal devices were used in the Apollo 
spacecraft. Among these were D'Arsonval meters, numeric displays, event indi- 
cators, annunciator lights, and several special flight instruments. 

D’Arsonval meters . - The D’Arsonval meter was the predominant display > 

instrument used in the Apollo CM spacecraft. A modified version of this type of 
meter, incorporating a feedback loop and termed a servometric meter, was used 
extensively on the LM. The basic simplicity and inherent response characteristics of > 

the meter, its compatibility with conventional analog transducers and signal condi- 
tioners, and the extensive experience with the D'Arsonval-type movement were the 
primary factors in its selection as the general type of display. 

Although the servometric meter provided improved accuracy and minimized 
vibration-induced pointer movement, the mechanism had certain undesirable features. 

One such feature, the necessity of providing a separate power input in addition to the 
signal input, required additional power, weight, wiring, and circuit breakers. 

Implementation of the requirement to provide a positive indication of meter failure or 
loss of input was also more difficult. The standard D'Arsonval meter inherently 
moves off scale with loss of signal and thus gives a positive failure indication. With 
the servometric meter, however, loss of the additional power input (or internal 
power) leaves the pointer at its last position. Unless the crewmen have another 
source of information, they are led to believe that the parameter is unchanged. This 
problem was circumvented in the LM by the addition of a small signal light above cer- 
tain critical displays. This light illuminated whenever meter input power was inter- 
rupted. In future programs, the standard D'Arsonval movement should be used, 
where possible, instead of the servometric design. Servometric displays, when used, 
should be designed to provide a positive indication for both loss of signal and power. 

The types of D'Arsonval and servometric meters used in the Apollo crew sta- 
tions included single- and dual- scale vertical meters, single- scale circular meters, 
dual-scale semicircular meters, and cross-pointer indicators. Minimization of 
panel space and crew preference for vertical meters were the primary factors in the 
selection of the type of meters to be used. To conserve panel space (and to reduce 
weight and electrical connections), dual-movement meters were used, where possible, 
for the display of related parameters. Crew comments about the poor readability of 
the dual-scale, semicircular meter configuration resulted in its omission from the 
LM design. For the purpose of standardization, circular meters were used to display 
communications and electrical power systems parameters in both vehicles. 

The dial faces of all D'Arsonval meters were transilluminated by the use of EL 
lighting. This type of meter face provided readability under a wide range of lighting 
conditions but did not lend itself to modification. The transilluminated markings on 
CM meters were produced by an etching technique, whereas a film overlay was used 
on the LM meters. Construction of new dial faces by either technique required a long 
lead time. When transilluminated meters are required for future applications, a flex- 
ible method for constructing dial faces should be adopted. Consideration should also 
be given to an improved method of implementing meter color bands. Color bands that 
denoted operating ranges, limits, and conditions were located directly on the meter 


14 



dial face in Apollo spacecraft. This method had two undesirable characteristics: 
meter disassembly was required to modify the color bands , and the paint on early LM 
meters flaked. 

Numeric displays . - Numeric displays of both the electromechanical rotating 
drum and the electronic EL-segment type were used for certain applications in which 
precise quantitative data were required and trend information was not of primary 
importance. Among the applications were the display of mission and event times, 
propellant quantities, and guidance-computer parameters. Early CM numeric indi- 
cators, except the display and keyboard (DSKY) assembly, were primarily electro- 
mechanical. When EL lighting was selected for the later CM and LM designs, the 
decision was made to use EL numeric indicators exclusively in the LM and to sub- 
stitute EL indicators in the CM where possible. 

Event indicators. - Electromechanical event indicators, more popularly known 
as ’’flags, ” were used to show the status of components or system elements. Gen- 
erally, these flags were used as indicators of discrete, normal events such as a valve 
opening or closing; but, in a few applications, they were used as malfunction 
indicators. 

Event indicators used D’Arsonval-type meter movements consisting of a signal 
flag attached to the end of a pivot arm. The flag would appear in view when the device 
was in one energy state and would deflect from view when in the other. Two-position 
indicators were predominantly used throughout both vehicles. A second, three-position 
configuration was also used for special applications requiring the display of three sep- 
arate status indications (e.g. , off, on, or failure indications). In this configuration, a 
gray flag meant that a monitored element was operating or was not inhibited from 
operating (valve open, power on, etc. ), a black-and-white striped indication meant that 
the element was deactivated or inhibited from operating (valve closed, power off, etc.), 
and a red indication meant that a monitored element had failed. Three-position flags 
were used on the LM to monitor the status of the reaction control system (RCS) thrust- 
chamber valves. A gray flag indicated an open valve; striped, a closed valve; and 
red, a failed jet. Flags were also classified according to the type of electrical actua- 
tion used. One type of indicator displayed a gray flag when energized and a striped 
flag when no power was applied. Another type of indicator worked in reverse. The 
type of flag indicator chosen for a particular application was normally the one that 
required the lesser operating power for the duration of the mission. For example, a 
’’gray deenergized” flag indicator would be used to monitor a valve that was open 
throughout most of the mission. Although power is conserved, this scheme is opera- 
tionally disadvantageous in that a deenergized indicator fails to give a positive failure 
indication. 

In most cases in which a flag indicator was used to monitor the condition of pro- 
pellant valves, the power to the flag was routed in series through valve-position- 
indicator switches of both the fuel and oxidizer systems. If the flag received power in 
the gray position, the conclusion was that both the fuel and oxidizer valves were 
’’positively open. " If the flag received power in the striped position, the conclusion 
was that both valves were ’’positively closed. ” Using this type of wiring logic, a 
positive-open flag could not provide a positive- closed indication; that is, removal of 
power and display of a striped flag could result from one of three conditions: fuel 
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valve closed, oxidizer valve closed, or both fuel and oxidizer valves closed. The 
opposite situation existed with positive-closed wiring logic. When mission plans and 
procedures began to form midway into the Apollo development, the indication was that, 
for certain cases, the ambiguities in determining actual valve configurations could not 
be tolerated. As a result, a considerable amount of rewiring was made in both the CM 
and the LM to interchange positive-open and positive-closed wiring logic. In future 
efforts, flag indicators should be powered in each active display position, where possi- 
ble, to provide positive status information. When this procedure is not possible, the 
operational ramifications of the flag-indicator wiring logic should be carefully 
scrutinized. 

Flags were used on Apollo spacecraft in preference to annunciator lights for 
general status indications. Their use conserved power, facilitated dark-adapted 
operations (such as star sightings), and helped to eliminate an objectionable 
’’Christmas tree” effect. Unfortunately, the inconspicuousness of flags could also 
easily allow an abnormal change in the state of the monitored element to go undetected 
by the crewmen. Therefore, flags were generally used as status indicators and not as 
caution or warning indicators. 

Annunciator lights. - Annunciator lights were used when a discrete, attention- 
getting display was required. On Apollo spacecraft, annunciator lights were generally 
used to provide subsystem or component malfunction information in association with 
the C&W system, but they were occasionally used as event indicators. The amber 
caution and red warning lights on both vehicles were grouped in a matrix and centrally 
located for easy visibility by all crewmembers. A master alarm light and an auditory 
alarm operated in conjunction with these lights. These alarms were activated simul- 
taneously with the pertinent C&W light whenever an out-of-tolerance condition existed 
among the monitored parameters. To distinguish between CM and LM failures, two 
different auditory signals were used. The CM used a dual-frequency (750 and 
2000 hertz) alternating tone; the LM, a single-frequency (3000 hertz) tone. The LM 
additionally used component caution lights, subordinate to the C&W lights, that showed 
which of several subsystem elements gated into a single C&W light had malfunctioned. 
The CM used flags for a similar function. 

To avoid the distraction of constantly illuminated annunciators, both vehicles were 
provided with annunciator extinguishment controls. This function was accomplished in 
the CM by using an operating mode (acknowledge mode) that removed the lighting power 
from the entire C&W lamp assembly, except when the master alarm was depressed. 
When a C&W alarm occurred, the master alarm light and auditory alarm would acti- 
vate as usual. By resetting the master alarm, the crewmen also enabled the C&W 
lamp power and could then observe which C&W lights were activated. An acknowledge- 
mode technique was not used in the LM; instead, separate controls were used to reset 
or inhibit the dedicated logic within the C&W electronics that enabled the power to a 
specific C&W annunciator. 

Problems were experienced with nuisance triggering of C&W annunciators on 
both vehicles. Some of the false alarms were eliminated before flight by the incorpo- 
ration of increased time delays within the C&W electronics. In other cases, the C&W 
logic of troublesome lights was completely disabled as a minimum-impact modifica- 
tion if alternate system information channels were available. The experience gained 
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in the area of Apollo C&W design indicates that the ideal C&W systems for future 
spacecraft would have the following capabilities: an acknowledge mode, dedicated 
resets/inhibits for each C&W channel, a memory or latching system for identifying 
the source of short-term abnormalities, a variable time delay for screening transients 
in individual C&W channels, and the capability to alter the alarm limits easily. For 
the last two features, trade-off studies should be performed to determine the advantages 
between onboard and ground adjustment schemes. 

A special-purpose bank of annunciator lights was used on the CM to display the 
status of the launch vehicle during boost. Eight lights, grouped within a 5.72- by 
8.26-centimeter (2.25 by 3.25 inch) area adjacent to the commander’s flight instru- 
ments, provided the fundamental booster status information required by the crewmem- 
bers during launch. By means of this display, the crewmembers could determine 
whether or not each booster engine was developing enough thrust, whether or not the 
booster guidance was functioning properly, and whether or not the staging sequence 
was proper . 

A unique annunciator was the LM lunar- contact light, which illuminated when 
3- meter (10 foot) long probes on the LM landing gear contacted the lunar surface to 
alert the flight crew to shut down the descent engine. These two lights, installed on 
each side of the panel, were also provided to compensate for a possible loss of external 
vision because of the formation of a dustcloud caused by the landing engine thrust. 

Each light was round and approximately 2. 5 centimeters (1 inch) in diameter. For 
distinction from all other annunciators, each light was equipped with a blue lens. 

Special flight instruments . - Several unique displays were developed especially 
for Apollo spacecraft. Among these were the CM and LM flight director attitude 
indicator (FDAI) devices, the CM EMS, the LM range/range- rate meter, and the 
DSKY combinations for the primary guidance, navigation, and control system (PGNCS) 
computers. 

Flight director attitude indicator: The FDAI, the primary flight display in both 
the LM and the CM, integrated into a single instrument the display of vehicle attitude, 
rotation rate, and attitude error. The display design was similar to that used for 
aircraft attitude and flight director indicators, except that attitude, errors, and rates 
were displayed for all three vehicle axes. Attitude was displayed on a sphere marked 
in an "inside looking out" fashion. Errors and rates were displayed with "fly to" 
needles. Attitude could be displayed to 1° , and the scaling for the error and rate 
needles could be changed to suit the flight situation. 

Numerous changes were made to the attitude indicators before and during pro- 
duction and after the initial Apollo flights. Changes were made for a variety of rea- 
sons. To obtain more precise monitoring of vehicle attitude during active maneuvers, 

5° yaw markings and 1° pitch markings were added. This requirement for improved 
attitude resolution resulted from Gemini reentry- targeting experience. At approxi- 
mately the same time, as a result of recently acquired experience in both CM and LM 
flight simulations, astronauts expressed the desire to eliminate unnecessary dissimi- 
larities in attitude sphere markings. The indicators in both vehicles were changed 
accordingly. Later, changes were made to the LM FDAI error and rate needle scaling 
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as a result of early Apollo flight experience. Later missions verified the belief that 
increased meter sensitivity would result in improved vehicle- control performance and, 
correspondingly, in less fuel consumption. 

One of the changes made to the LM FDAI stemmed from ambiguities in interface 
control documents. As a result, the FDAI units were mistakenly miswired for ”fly 
from'’ needle operation instead of the standard "fly to" relationship. Fortunately, 
this situation could be, and was, corrected by interchanging the two signal reference 
leads to the display. In future programs, generic functional requirements should be 
identified and clearly delineated at the earliest possible date. The end-to-end response 
between vehicle movement and display movement should be described and illustrated 
within pertinent program documentation. 

Entry monitor system: The CM EMS was more than just a special display. The 
EMS was, in fact, a self-contained guidance package that allowed the crewmen to 
monitor, independently, the performance of the automatic PGNCS during entry and 
thrusting maneuvers. The EMS also displayed sufficient information to enable per- 
formance of a manual entry if a PGNCS failure occurred. 

The EMS assembly (fig. 10) contained five separate displays. An entry thresh- 
hold annunciator light illuminated at 0.05g to show that atmospheric deceleration had 
been sensed. A roll attitude indicator 
(RAI), a circular meter with a moving 
pointer, displayed roll attitude and, thus, 
lift-vector position throughout the entry. 

Two entry-corridor-verification annunci- 
ators were integral to the RAI. One of 
these two lights would illuminate approxi- 
mately 10 seconds after the start of entry 
to indicate the necessity of having the lift 
vector up or down to accomplish a suc- 
cessful entry. If the upper light illumi- 
nated, the lift vector had to be up; if the 
lower light illuminated, the lift vector had 
to be down. A delta-velocity/range-to-go 
indicator, which was an EL numeric read- 
out, served one of three functions depend- 
ing on the positions of the mode and 
function switches controlling the EMS. 

During entry, the indicator displayed the 
inertial flightpath distance in nautical Figure 10. - Entry monitor system, 

miles to the predicted splashdown point. 

For thrusting maneuvers, the indicator 

displayed velocity change in feet per second; for rendezvous, it displayed the range to 
the LM in hundredths of a nautical mile. The fifth EMS display was a scroll assembly 
that provided a scribed trace of acceleration as a function of inertial velocity through- 
out entry. The scroll had printed contour guidelines that allowed the crewmembers to 
monitor or control the spacecraft acceleration profile and range potential. 

Range/range-rate meter: The LM range/range-rate meter displayed radar- and 
guidance- sensed ranges and range rates between the LM and the CM and between the 
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LM and the lunar surface. The display was a dual-scale, fixed-pointer, moving-tape 
indicator. Range was displayed on a moving tape located to the left of a centrally 
positioned fixed pointer. The range-rate tape was to the right of the pointer. This 
type of display was selected so that the requirements for a large data range and reso- 
lution plus trend information could be met. The indicator was one of the most complex 
display devices used on the Apollo spacecraft and contained approximately 500 elec- 
tronic flat packs plus the mechanical drive for moving the tape. The large amount of 
electronic circuitry was needed to condition the various digital and analog input signals 
coming from several different sources and to provide malfunction-detection circuitry 
to monitor all signal and power inputs. As with servometric meters, special circuitry 
was required to provide a positive indication of loss of input power. Each of the two 
display tapes was approximately 3. 6 meters (12 feet) long. Digital encoding with a 
gold-plated "gray code" on the back of the tapes provided feedback information for 
improved display accuracy. 



Display and keyboard assembly: The displays used to communicate with the CM 
and LM PGNCS computers were part of an integrated DSKY assembly (fig. 11), a piece 
of equipment common to both Apollo vehi- 
cles. The CM had two DSKY assemblies 
that operated in parallel; one DSKY was 
located in the MDC and the other at the LEB 
G&N station. The LM contained a single 
DSKY located between the two crewmen. 

The DSKY consisted of two groups of dis- 
plays : on the left was a group of annunci- 
ator lights that showed computer status or 
caution conditions; on the right were an EL 
numeric display and a computer-activity 
annunciator. The numeric display fulfilled 
three basic functions: display of computed 
data on both one-time and periodic update 
bases; display of data being loaded for ver- 
ification by the crewman; and display of 
the operation (verb), the operand (noun), 
and the major mode (program) under which 
the computer was working. 


Figure 11. - Apollo display and 
keyboard. 


The data being entered into or read 
from the computers were displayed on 
three five-digit registers. The verb, noun, 
and program displays were two-digit read- 
outs showing the code numbers for the action being performed. For example, pro- 
gram 52 was used to realine the inertial platform; verb 25 meant load the data in 
registers 1 to 3; and noun 35 was the time from an event in hours (register 1), minutes 
(register 2), and seconds (register 3). The EL-segmented alphanumeric displays were 
used for the data registers. 


The LM included a dedicated keyboard for communication with the abort guidance 
system (AGS) and the AGS computer. Whereas the PGNCS DSKY was intended and 
designed for general use, the AGS data entry and display assembly (DEDA) was designed 
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as a special-purpose device to be limited 
to the displaying and processing of AGS 
abort-related parameters. Therefore, a 
single-address register, a data register, 
and an "operator error" annunciator light 
were adequate. An LM DEDA is illus- 
trated in figure 12. 


DESIGN DEVELOPMENT 


Generally, the D&C design develop- 
ment was an evolutionary process that fol- 
lowed the development of the overall CM 
and LM vehicles. After the initial designs 
were completed, most of the factors that 
shaped and modified the D&C were gener- 
ated outside the subsystem, primarily from 
changes in interfacing subsystems or from 
revised operational techniques. The devel- 
opment paths and milestones for both the CM and the LM D&C were similar (although 
on different schedules), and the chronologies of both vehicles were essentially the 
same as for the respective crew stations. 



Figure 12. - The LM data entry and 
display assembly. 


Command Module 

Early in the Apollo Program, pushbutton switches were proposed for extensive 
use in the CM; however, pushbuttons were not used as the general switch type for a 
number of reasons. One reason was that, for a two- state function, a pushbutton 
generally required more panel space than a toggle switch. Second, the designs of 
pushbutton switches were more complicated than the designs of toggle switches. Third, 
the design of a maintaining type of pushbutton was additionally complicated because the 
pushbutton required the use of a relatively complicated internal or external latching 
mechanism or the use of external latching relays. A fourth disadvantage of pushbutton 
switches was the problem of a "Christmas tree" effect created by pushbuttons equipped 
with integral status lights. Constantly illuminated signal lights are distracting, tend to 
mask other important signal lights, and result in unwanted reflections in the space- 
craft windows. Therefore, the toggle switch, instead of the pushbutton, was chosen 
as the general switch type for Apollo spacecraft. 

At the time of the initial CM design, the decision to use the lunar orbit rendez- 
vous (LOR) mode of operation had not been made. After the selection of the LOR mode 
with a separate LM, the CM had to be provided with the added capabilities for docking 
and crew transfer. As the design development proceeded, the need arose to reduce 
the CM weight, to improve reliability, and to incorporate numerous system modifica- 
tions that early experience had shown to be necessary. The lunar- mission spacecraft 
that incorporated all these changes and added capabilities were designated Block II 
spacecraft. The initial Block I design was continued, but strictly as research and 
development spacecraft for Earth-orbital tests. 
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The Block II design point was one of the few times that truly major changes were 
made in the CM D&C configuration. Because weight had to be reduced and because the 
concept of in-flight maintenance had been deleted, the panel structure and wiring were 
totally revised. The 20 small, sheet metal panels making up the MDC on Block I were 
replaced by 3 large, machined panels for Block II, and the service loops on the panel 
wiring harnesses were eliminated. (Subsequent experience has shown that retaining 
the service loops or having rear service access to the panels would have been a major 
benefit to ground modifications and checkout operations. ) The EL integral panel and 
display lighting were also added for Block II; only the FDAI (which was incandescent) 
in Block I was integrally lit. The layout of the D&C was also revised extensively to 
accommodate the numerous subsystems changes. 

The following detail changes to the D&C configurations resulted from the 
Block II redesign. 

1. The FDAI was redesigned and repackaged to incorporate EL integral lighting 
and a single reference index. (The Block I FDAI had two reference symbols because 
the vehicle and navigation axes did not coincide. ) A second FDAI was also added for 
redundancy and operational flexibility. 

2. Displays and controls were added to accommodate the newly acquired high- 
gain antenna and docking-probe systems. 

3. The crew control of the stabilization and control system was changed from 

a mode- selection scheme to a function- selection arrangement. This change improved 
overall system reliability and provided additional operational flexibility. More 
switches were required for function selection because this scheme allowed manual 
and alternate selection of individual system components or functions. For example, 
the earlier mode- selection scheme had automatic FDAI error- needle scaling on the 
basis of preselected values. However, the function- selection arrangement incorpora- 
ted a scaling switch that permitted the crewmen to select the scaling desired for a 
particular operation. Although function selection unquestionably gave greater flexibil- 
ity, the approach also had two undesirable side effects. First, this approach 
increased the number of switches that had to be positioned and monitored; second, 
increasing the number of switches increased task times, complicated training, and 
raised the possibility of inadvertent or improper switch combinations. The principal 
advantage of the function- selection scheme may have been its capability to accommo- 
date changes in vehicle flying techniques. By contrast, most features of the mode- 
selection scheme were hardwired into the system. 

4. Flag event indicators that worked in conjunction with switches were moved 
from below the switch to above the switch so that the operator's hand did not block 
visibility during operations. 

5. The EMS development was continued strictly as a Block II item, and the 
device was deleted from Block I spacecraft. 

The deletion of the in-flight- maintenance concept also meant that an elaborate 
in-flight test system would no longer be required; therefore, the system was reduced 
to a single voltmeter and two multiposition switches. This systems test meter, as it 
came to be called, was used to check out certain equipment and monitor parameters 
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that had low criticality or that required a very low checking frequency. The positions 
of one rotary switch were identified with letters and the other with numbers. The 
meter displayed test values between 0 and 5 volts. A decal that identified (1) the 
parameter displayed with a given switch position; (2) the nominal, maximum, and 
minimum meter readings; and (3) the corresponding engineering units for the voltage 
readouts was provided for use with the systems test panel. 

After the Apollo CM fire, many changes were made in a relatively short time. 
The primary impact on the D&C was that certain ECS controls were relocated to 
improve crew access. Holes were added to most D&C panels as ports for insertion of 
a fire extinguisher nozzle in the unlikely event that a fire erupted behind the panel. 

The flammable plastic control knobs were also replaced with metal knobs. 

Several individual changes in the D&C occurred as the design evolved. The 
first change involved the nucleonics quantity measuring system developed for the 
service module and LM reaction control system. This gaging system consisted of 
many small radioactive sources placed externally on one side of an RCS tank and a 
scintillator-photomultiplier counter placed on the other side. The idea was that the 
propellant would scatter or absorb radiation at a rate proportional to the quantity 
remaining in the tank. This quantity would then be displayed on a digital readout. A 
Nixie tube display was baselined for the CM — the only spacecraft application of such 
a display. Unfortunately, problems were encountered in the development program; 
the cost increased, and the system was canceled. As a result, an indirect quantity 
gaging system had to be used. A pressure/temperature ratio transducer monitored 
the RCS helium tank that supplied propellant pressurization. The output of this trans- 
ducer drove an analog meter that was calibrated to read the corresponding propellant 
quantity. 

Problems in the development of toggle switches caused changes in vendors, 
redesigns, and numerous refinements in screening processes. One result of these 
problems was a requirement to provide redundant parallel switches, each having 
redundant contacts wired in series parallel fashion, for the most critical pyrotechnic 
functions on the command and service module spacecraft. 

Another significant D&C development was the addition of the orbital-rate drive, 
Earth and lunar (ORDEAL), assembly to the CM and the LM. Because the Apollo 
spacecraft was conceived primarily as a nonorbital vehicle, its guidance and control 
scheme was based on a strictly inertial reference system without any capability for a 
local-vertical or a local-horizontal orbital mode. Gemini experience, however, 
showed that the crewmen required a rapid and accurate method for determining the 
angle between the relative line of sight and the local horizontal during rendezvous 
maneuvers. When the requirement was firmly established, the CM and LM designs 
had progressed too far to enable incorporating the requirement easily or cheaply into 
the existing systems. To fulfill this need, the ORDEAL was designed as a black box 
with integral controls that could literally be hung on the wall and wired to drive the 
FDAI at an orbital rate. The ORDEAL box installed in the CM is illustrated in 
figure 13. 
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Lunar Module 

After the initial design was finalized, 
the LM did not undergo a major redesign 
such as the CM block changes. The major 
development change to the LM D&C con- 
sisted of replacement of fuel cells and 
associated cryogenic supplies with bat- 
teries. The displays and controls associ- 
ated with a battery are much less numerous 
than those for a fuel cell and cryogenic 
system; thus, the net result of this change 
was to simplify the LM D&C. 

An interesting LM D&C component 
development was that of the cross-pointer 
indicator. This instrument provided simul- 
taneous display of forward and lateral veloc- 
ities during landing and of line-of- sight azimuth and elevation angles for rendezvous. 
The initial proposal was that the display be an EL grid and that the drive signals be 
digital. Advantages of this implementation were improved system accuracy and 
elimination of parallax. After much study, however, the analog-meter cross pointer 
was retained because of the impact of converting to an all-digital system. 

Similarly, feasibility studies and simulations were conducted to analyze the 
desirability of using digitally driven attitude indicators. Problems of attitude- sphere 
response and information lag were identified, and this concept was therefore dismissed. 
Apollo software, it should be noted, was generally limited to outputting information at 
a rate of 10 times per second. With the miniaturization of software logic, the state-of- 
the-art '’refresh” techniques, and the advances in display designs that currently exist, 
digital displays would now possibly be feasible. 

Special problems were encountered with the LM engine- stop pushbutton switch. 

On several occasions during ground checkout operations, this switch was inadvertently 
reset from the "on” state (engine off) to the "off” state (engine on). If this condition 
had occurred during lunar touchdown, the result could have been catastrophic. To avoid 
such a catastrophe, an external "positive actuation device” was added to the push- 
button to hold the switch in the internally latched position. Unfortunately, numerous 
problems were experienced with the device itself, but these were resolved before the 
first lunar landing. In future efforts, the use of maintaining- type pushbuttons for 
accomplishing critical switching functions should generally be avoided. 



Standardization 

The principles of commonality and standardization of equipment received much 
emphasis early in the Apollo Program. As a result, commonality studies were con- 
ducted to examine the feasibility of using Gemini hardware or other common hardware 
(or both) in both Apollo vehicles. The results of these studies indicated that the dif- 
ferent development schedules and different environment requirements of the three 
vehicles eliminated the use of most common hardware. Therefore, the initial CM and 
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LM D&C designs did not include a single piece of equipment that was common to both 
vehicles. Later in the program, however, the operational advantage of a standard 
DSKY configuration became apparent, and a common (although not interchangeable) 

DSKY was procured for use in both the CM and the LM. For similar reasons, when the 
requirement for the ORDEAL was later identified, common equipment was procured 
from a single source. Later in the program, toggle switches, circuit breakers, and 
mission timers also became common equipment because of problems in the hardware 
being procured from Apollo vendors. 

The goal of functional standardization was ultimately achieved by two methods. 
First, interface control documents were established among the prime vehicle contrac- 
tors, the G&N systems contractor, and the NASA Lyndon B. Johnson Space Center 
(JSC) (formerly the Manned Spacecraft Center (MSC)). These documents formally 
defined and standardized the basic D&C functional requirements to eliminate conflicting 
design features. Among the items standardized were panel controls, display faces, 
annunciators and flag indicators, nomenclature, markings and colors, and lighting. 
These documents established a basic compatibility "ballpark" in which detail design- 
ing could be done. The second factor in achieving standardization — less formal than 
the first but just as important and effective, especially in day-to-day work in specific 
details — was that the D&C efforts for both the CM and the LM were monitored by the 
same group at MSC. This arrangement encouraged and facilitated constant communica- 
tion between the cognizant engineers and helped to achieve further compatibility in the 
CM and LM D&C designs. 

For future efforts, a set of D&C functional requirements specifications has been 
prepared. These documents, based on manned spacecraft experience to date, include 
a compilation of requirements from the Apollo interface control documents and applica- 
ble military standards. The intent of these specifications is to identify basic consider- 
ations, criteria, parameters, and values of benefit to D&C systems designers, and to 
maximize crew efficiency by standardizing functional characteristics and thereby reduc- 
ing the possibility of ambiguity. These specifications cover the basic entities of dis- 
plays and controls including lighting; nomenclature, markings, and color; abbreviations; 
displays; and controls. 


OPERATIONAL EXPERIENCE 


The first five manned Apollo missions (Apollo 7 to 11) provided more than 
1000 hours of flight operations; the D&C subsystems, as a whole, worked well and met 
all design objectives during these- missions. Flight crews reported that the displays 
provided the required information and were read easily even under the most severe 
environmental conditions, that the markings and nomenclature were satisfactory, and 
that the controls gave the needed command capabilities and were operated easily. Many 
of the D&C anomalies reported on Apollo flights were not directly attributable to the 
D&C equipment itself but to anomalies within interfacing equipment (e.g. , instrumenta- 
tion). Discussions of these types of anomalies have generally been omitted in this 
report. 

In a sense, operational experience with the D&C system began well before the 
first manned Apollo flights. Valuable knowledge of D&C subsystem performance was 
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gained both from unmanned orbital flights and from manned thermal-vacuum chamber 
tests. Unmanned developmental command modules were equipped with sequence 
cameras that photographed portions of the MDC and obtained forward-window views 
during some of the critical mission phases (such as entry). Verification of the flight 
performance of certain critical displays was believed to be a contributing factor to 
manned Apollo missions. 

Mission AS- 202 was one of the early unmanned flights that provided operational 
experience. Postflight examination of telemetry data and of in-flight motion pictures 
of the panels revealed that most of the displays operated normally. The data also indi- 
cated that those displays that did not respond as expected were actually only reflecting 
problems in the subsystems. For example, an improper FDAI attitude indication that 
existed throughout the flight was caused by an alinement error in the platform, and a 
fuel cell C&W annunciator illuminated because of a low oxygen flow rate. 

Because LM vehicles could not be recovered, the LM panels were not photo- 
graphed in flight. A study conducted to determine the feasibility of using the Apollo 
television camera for real-time D&C assessment proved this approach to be imprac- 
tical, primarily because of the unavailability of communications channels and receiving 
stations . 

Manned thermal-vacuum chamber tests were performed for both the CM and the 
LM by using special test spacecraft. These tests permitted a combined environ- 
mental and operational assessment of the Apollo D&C. In conjunction with the primary 
duty of man-rating the spacecraft, astronauts manning the vehicles during these tests 
assessed the following D&C areas: readability of displays and accessibility of con- 
trols, torques and forces required to actuate controls, interference with D&C panels 
during normal operations, comparison of onboard display readings with telemetry and 
control-room readings, operation of the C&W system, and general acceptability of 
lighting. With few exceptions, the displays and controls for both vehicles were found 
to be acceptable. These tests were especially helpful because they enabled determina- 
tion of operational quirks within the D&C and vehicle subsystems. Numerous prob- 
lems with transient and false C&W alarms were encountered. As a result, significant 
changes were made to C&W systems within the flight vehicles. In other cases, pro- 
cedural workarounds were established. 


Apollo 7 Mission 

The primary purpose of the Apollo 7 mission, the first manned CM flight, was 
to check out and gain experience with the spacecraft systems. At the postflight debrief- 
ing, the crewmembers reported that, in general, the D&C configuration and operations 
were very satisfactory. Control forces and torques were found to be satisfactory under 
all the differing acceleration conditions and were great enough to preclude inadvertent 
control actuations. The displays were readable, but several meters were found to be 
less accurate than had been anticipated. A problem with washout of the EL readouts 
of the EMS, the DSKY, and the mission timer was also experienced. Sun shafting, 
particularly through the side hatch window, occasionally made these displays unread- 
able. As corrective action, portable shades were provided to shield these displays on 
later missions. The panel nomenclature and markings were reported to be satisfac- 
tory, and the EL panels provided excellent readability even in a darkened cabin. 
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The Apollo 7 flight crew found that the frequency of timing operations warranted 
an additional timer for use by the crewman who occupied the right-hand couch. The 
use of either another event timer or a ’’kitchen timer” was suggested. An evaluation 
of the impact of adding another event timer resulted in provision of a kitchen-type 
timer for subsequent missions. A new nonflammable case was made, and the timer 
was tested to ensure that there was no harmful outgassing. This modified household 
timer proved to be especially useful because of its portability, lack of interfaces, and 
built-in signal bell. 

Two D&C hardware failures were experienced on the Apollo 7 mission. A crack 
developed in the optical glass window of both mission timers, and the EMS delta- 
velocity/range-to-go display malfunctioned before lift-off. Fortunately, the mission- 
timer glass did not come loose, and timer operation was unaffected. Postflight 
investigations revealed that the cracking resulted from stress induced in the glass 
during manufacturing. The nature of the failure did not warrant redesign of the timers; 
but, to compensate for this type of failure on later missions, transparent tape was 
installed over the display windows of both mission timers to prevent the release of 
glass particles within the crew compartment. Loose particles constitute a special 
danger in a zero-g condition because these particles float freely within the cabin and 
can easily be ingested by the crewmen. Investigations after the mission disclosed that 
the EMS failure was apparently caused by a poor solder connection and a poor wire- 
crimp connection within the EMS, 


Apollo 8 Mission 

The Apollo 8 mission was the second manned flight and the first manned lunar 
orbit mission. Again, the crewmembers reported that the displays and controls were 
very satisfactory. The kitchen- type timer recommended after the Apollo 7 mission 
proved to be very useful, particularly for timing fuel cell purges. However, the panel 
shades that were provided to prevent washout of the EL numerics were generally 
ineffective. The best solution was to shade the displays with one hand during the 
occasional periods when washout occurred. 

Before the flight, the Apollo 8 crewmembers wrote various supplemental systems 
information on the D&C panels. This additional information proved to be very useful 
to the crewmembers during the flight. As a result, a system was established for sub- 
sequent missions in which, shortly before flight, operational information of a supple- 
mental or "memory jogger” nature was collected from the crewmembers and was 
verified, documented, and placed on metal foil decals that were then added to the 
spacecraft panels. Examples of these decals are illustrated in figure 14. 

Only one D&C-associated hardware problem occurred during this flight — four 
times during the mission, abnormal indications existed on the delta-velocity counter 
or the scroll display. Postflight investigations disclosed a bubble in the accelerometer 
that could have caused some of the problems. The remainder of the anomalies resulted 
from using the EMS to monitor small accrued velocities, a job for which it was not 
designed. However, a procedural workaround was developed so that, on subsequent 
missions, the EMS could be used for such monitoring, if desired. 
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Apollo 9 Mission 


The Apollo 9 mission, the first 
manned LM flight and the first joint CM and 
LM mission, was intended both to qualify 
the LM spacecraft and to demonstrate, in 
Earth orbit, combined LM/CM operations. 
Although the D&C for both vehicles func- 
tioned satisfactorily, several problems 
occurred, chiefly in the CM. 

During the first scheduled LM/CM 
separation (undocking), the "probe extend/ 
release" switch was actuated, but the vehi- 
cles did not physically unlatch until the 
third attempt. Then, on retracting the 
probe in preparation for redocking, the 
status indicators showed that the probe latches were not cocked for docking. Cycling 
the docking probe produced the proper indications, and docking was completed satis- 
factorily. Indications were that these anomalies did not result from any control or 
probe failure but from a procedural problem caused by not holding the probe switch in 
the "extend/release" position long enough to complete the release and latch-cocking 
sequences. For subsequent flights, the operational procedures were changed to 
reflect this operating time, and the problem was not repeated. 

Some of the Apollo 9 docking problems could have possibly been avoided if the 
crewmembers had been provided with additional docking system information. A two- 
position (gray/striped) flag indicator was used to monitor all docking-probe operations. 
This approach inherently limited the amount of information that could be displayed and 
easily led to confusion because the meaning of the displayed indication was different at 
different times in the operating sequence. In the future, if status information is needed 
to monitor docking or other multiposition mechanical systems, consideration should be 
given to providing a discrete indicator for each event in the system operating sequence. 

Several C&W system anomalies occurred during the Apollo 9 mission. On three 
occasions, a C&W master alarm occurred without the illumination of any C&W annun- 
ciator and without the identification of any out- of- tolerance condition. In-flight and 
postflight analysis revealed that these unexplained alarms were probably caused by 
externally induced transients rather than by malfunctions within the C&W electronics. 

A problem was also encountered with certain service propulsion system C&W circuits. 
On eight occasions during the three firings of the service propulsion engine, a C&W 
light indicated an excessive unbalance in the propellant quantities. Two of the eight 
failure indications were found to be caused by actual unbalances, but the remainder 
were attributed to either an unexpectedly long propellant settling time or a bias in the 
quantity measuring system. Analysis of all the flight data showed that balancing the 
propellant usage was not as critical as had been anticipated. To avoid numerous 
nuisance alarms, this C&W function was disabled on succeeding spacecraft. 

One minor problem experienced on the Apollo 9 mission was directly attributable 
to an error in panel markings. Problems in repressurizing the surge tank resulted 



Figure 14. - Supplemental decals. 
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from a 20° misalinement between the ECS panel markings and the control-valve detent 
position. The control position indexes had simply been mislocated during manufactur- 
ing, and the error was not detected before flight. 

As on earlier missions, a problem with the Apollo 9 EMS was experienced. The 
scroll assembly failed to scribe a trace of acceleration as a function of inertial veloc- 
ity during entry. Postflight testing disclosed that the environmental seal for the 
scroll assembly had a large leak. The scroll coating was susceptible to moisture, and 
a subsequent slow drying would cause the coat to harden. Apparently, ambient air 
leaking through the broken seal provided the moisture, and the 10-day mission at a 
2 

34 470-N/m (5 psia) cabin pressure provided a slow vacuum drying that hardened the 
coating so that the scribe did not provide a trace. Special photographic techniques 
revealed that the stylus had traced properly on the film. 

Three D&C-related problems occurred in the LM used for the Apollo 9 mission. 
Because the LM did not return to the Earth, as did the CM, a rigorous postflight 
analysis similar to the type conducted for the CM was not possible. Precise identi- 
fication of the cause of an anomaly was therefore often impossible. Problems were 
experienced with the AGS keyboard, the C&W system, and the range indicator. When 
the "clear” pushbutton on the AGS keyboard was operated, the operator- error light 
illuminated on a number of occasions. Four or five additional switch activations were 
then required to extinguish the light. (The light would extinguish momentarily with 
each subsequent switch activation. ) This problem was attributed to the improper 
operation of one of the two microswitches contained in the pushbutton. Simultaneous 
activation of both switches was required to extinguish an operator-error light. The 
condition was accepted on the Apollo 10 mission. However, for Apollo 11 and subse- 
quent missions, a wiring change was made so that activation of either switch within 
the "clear" pushbutton would deactivate the operator-error light. 

A second LM problem was the illumination of an AGS failure light. Subsequent 
system performance and the normalcy of instrumented system parameters reduced the 
probability of an actual AGS failure. The conclusion was that the alarm was probably 
caused either by a short-circuited or broken wire between the AGS, signal conditioning, 
and C&W equipment or by a failure in the signal conditioning or C&W equipment. 

The LM range indicator also caused some problems, not because it failed but 
because it behaved differently than the meters on which the crewmembers had trained 
in the mission simulators. In flight, the tape responded in irregular steps, whereas 
the simulator displays exhibited a smooth slewing of the tape. The action of the flight 
display was normal and was caused by two factors: the digital nature of the input 
signals and drive mechanism and, the more influencing factor, the use of different 
scale units among the four input sources to the meter. The internal scale factor was 
applied according to both the source selected and the portion of the range tape being 
used. The simulator displays were basically analog instruments and, because of 
existing software limitations, had not been programed to respond like the actual units. 
Unfortunately, because of the limited number of opportunities to observe integrated 
range-indicator operation before flight, the Apollo 9 crewmen initially interpreted the 
digital response of the range indicator to be abnormal. To avoid this situation in 
future efforts, a list describing any static or dynamic differences that exist between 
flight vehicles, crew trainers, and simulators should be maintained. 


28 


Apollo 10 Mission 


The Apollo 10 mission, the first lunar flight of the complete Apollo system, was 
intended to verify all aspects of the lunar-landing mission, except for the actual LM 
landing, lunar surface operations, and ascent. The D&C of both vehicles again per- 
formed well with only a few minor problems. 

Three D&C-related problems were encountered in the CM. The launch vehicle 
annunciator assembly operated intermittently during prelaunch checkout. Each of the 
eight status lights in the annunciator assembly had two redundant lamps, and one lamp 
in each of four different indicators operated intermittently. Results of postflight 
analysis showed that each of these lamps had cold solder joints. 

A second problem existed with the digital event timer. On one occasion, the 
timer advanced 2 minutes; on other occasions, the timer failed to advance the tens-of- 
seconds count. The failure of the event timer in the tens-of-seconds count was found 
to be caused by contamination of an electrical contact when a motor gear rubbed against 
a display wheel and flaked the paint. The 2-minute jump could not be reproduced and 
was thought to have been caused by electrical noise to which the timer had proved to 
be sensitive. 

The third CM D&C failure concerned the EMS. After successful completion of 
the preentry test, the stylus of the scroll assembly stopped scribing. When the scroll 
was slewed back and forth, the stylus cut through the emulsion and then performed 
normally throughout entry. Investigations disclosed that the base of the emulsion 
used on the scroll was a latex rubber and soap mixture. The formula for the com- 
mercially prepared soap used in the mixture had been changed, and the new formula 
caused a chemical reaction with the film and hardened the emulsion. Lack of time 
prevented making any change for the next mission; however, a decision was made 
that, for succeeding vehicles, either the scroll emulsion base would be made from the 
original soap compound or a pressure-sensitive scroll, which had been recently 
qualified, would be used. 

Several D&C-related problems were encountered on the Apollo 10 LM. The 
first problem occurred when the LM was initially manned. The glycol temperature 
indicator displayed zero with the water/glycol pump switch in the pump 2 position. 

When the switch was in the pump 1 position, the temperature display was normal. 
Because the configuration was such that a jumper wire connected the pump 1 and 
pump 2 contacts so that the primary glycol temperature was displayed when the switch 
was in either position, it was assumed that either the jumper broke or complete con- 
tact was not made when the switch was in the pump 2 position. 

The second problem concerned several master alarms that occurred during the 
descent-engine phasing maneuver. The first alarm, which occurred concurrently 
with engine ignition, indicated a low descent-propellant quantity. The low-level indica- 
tion was proved erroneous and was believed to have been caused by a gas bubble that, 
in zero-g, uncovered the low-level sensor in the propellant tank. The C&W electronics 
system was designed such that, once a low level was detected, the circuit would latch 
and the descent low-propellant light would remain illuminated until reset manually by 
the flight crew. When the light was activated on the Apollo 10 mission, however, it 
failed to remain illuminated. Telemetry showed a constant low-level condition, an 
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indication that there was also an intermittent open circuit downstream of the telemetry 
point. To prevent the recurrence of nuisance master alarms on subsequent flights, the 
descent-propellant low- quantity input to the master alarm was eliminated on the 
Apollo 11 LM and subsequent vehicles. A second reason for disabling this light was 
that activation of the light caused by a true low- quantity condition might prove distract- 
ing to the crewmembers during the final phase of lunar landing. A decision was made 
that alternate onboard displays and telemetry would be ample for monitoring propel- 
lant quantities. 

The final D&C-related problem was associated with what was probably the most 
harrowing experience of the flight. Shortly before and during the LM staging sequence, 
vehicle gyrations were experienced at rates as great as 19 deg/sec in pitch and 25 deg/ 
sec in roll and yaw. Telemetry and vehicle response indicated that, coincident with 
the maneuvers, the abort guidance mode switch was moved from the attitude-hold 
position to the automatic position. As a result, the guidance system subsequently, 
and correctly, generated steering commands to point the Z-axis of the LM at the CM 
instead of maintaining the existing attitude. The crewmembers, thinking that they had 
reselected the semiautomatic attitude-hold mode, did not anticipate the automatic 
maneuver and, subsequently, attempted to override it. Fortunately, the crewmen were 
able to restabilize the vehicle and complete the rendezvous maneuver. After an exten- 
sive investigation, the conclusion was that the primary cause of the problem was the 
occurrence of an erroneous signal output from the yaw-axis rate gyro. In responding 
to the rate gyro error, a crewman probably inadvertently placed the mode switch in 
the automatic position and, thus, caused the large vehicle movements. This situation 
could possibly have been avoided by the use of larger toggle switch displacement 
angles (i.e. , by providing better switch-position indexing). For future efforts, dis- 
placement angles that are greater than the 17° used on Apollo missions should be 
provided. 


Apollo 11 Mission 

The Apollo 11 mission was the first lunar-landing mission. With it, the basic 
goal of the Apollo Program — landing man on the Moon and returning him safely to 
Earth — was accomplished. Once more, both spacecraft performed well, and only 
a few relatively minor D&C problems occurred. 

The CM had two problems with the D&C. The first concerned the mission timer, 
which ran slowly and developed cracks in the glass face. Both these problems had 
occurred previously and were attributed to electromagnetic interference and to 
manufacturing-induced stresses, respectively. Because of the history of problems and 
the failure of the identical LM timer during this mission, a redesigned timer was pro- 
cured for use on future CM and LM vehicles. 

The other CM D&C problem was the failure to illuminate an EL segment on the 
EMS delta- velocity/range counter. This failure was believed to have been caused by 
the misrouting of logic control wires across a terminal strip having sharp wire ends. 
These sharp ends punctured the wiring insulation and caused short circuits to ground. 
The numerous successful operations experienced until that time indicated that the 
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failure was probably neither a generic nor a design problem. To lessen the probability 
of a repeat failure, all test and checkout procedures were examined to determine 
whether or not improvements could be made toward further ensuring the proper opera- 
tions of all EL segments. 

Three D&C-related anomalies were encountered in the LM. The first occurred 
shortly after touchdown when the mission timer stopped and could not be restarted. 
Power to the timer was turned off. Approximately 11 hours later, the crewmen 
successfully restarted the timer. The timer functioned normally for the remainder of 
the mission. Previous experience with the timers indicated that the most probable 
cause of failure was a cracked solder joint caused by differential thermal expansion 
within the cordwood construction of the timer. Because the existing timers were not 
suitable for redesign, new timers, which were mechanically and electronically inter- 
changeable with the existing ones, were designed for both the LM and the CM. These 
new timers were installed on the Apollo 13 spacecraft and subsequent vehicles. A 
timer of the earlier design was flown on the Apollo 12 spacecraft because of schedule 
considerations. 

The second LM D&C failure was of an EL segment in the AGS DEDA. The seg- 
ment failure made it impossible to differentiate between a "3" and a ”9” on the third 
digit of the display. This failure did not make the DEDA unusable but did cause some 
ambiguity in the readout. The exact cause of the failure could not be determined, but 
the conclusions and recommendations were the same as for the similar CM EL failure 
discussed previously. 

The third LM D&C anomaly did not result in any operational degradation but was 
potentially the most hazardous situation. On completion of the lunar surface extrave- 
hicular activity (EVA), the crewmen discovered that the knob of the engine-arm circuit 
breaker was broken off and that two other breakers had been closed. Fortunately, the 
damage did not prevent closing of the engine-arm circuit breaker for ascent, but loss 
of the knob did mean that the breaker could not have been manually opened if required. 
The most probable cause of the damage was an impact from the oxygen purge system of 
the extravehicular mobility unit during EVA preparation. Postflight investigations in 
an LM mockup demonstrated the possibility of such an impact, even though the LM 
circuit breaker panels were terraced by design to provide protection. For the Apollo 12 
LM and succeeding lunar modules, an extended barrier guard was added to the edge of 
the circuit breaker terraces. 


CONCLUDING REMARKS 


Proven aerospace design practices and components, which were modified only as 
required to meet the unique aspects of the Apollo missions, were used in the develop- 
ment of the Apollo displays and controls system. Although a few display and control 
malfunctions occurred on each flight, none of these failures placed either the crewmen 
or the mission in jeopardy. The redundancy designed into the displays and controls 
system ensured both crew safety and mission success in all cases. Generally, the 
performance of the displays and controls system was excellent. 
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The Apollo experience was an indication that most of the Apollo displays and con- 
trols philosophies and designs would be applicable to future vehicles, and their use 
would facilitate both development and operations. Recommendations for improvements 
and the identification of problem areas are made throughout this report. Three of the 
more significant recommendations follow. 

1. The displacement of toggle switches should be increased from the nominal 17° 
used on Apollo spacecraft. 

2. Flag indicators should be powered in each active position whenever possible. 

3. Service wire loops or access to the rear of displays and controls panels 
should be provided to aid checkout and maintenance. 

To aid in future design efforts, a series of displays and controls functional require- 
ments specification documents has been prepared and is available from the NASA 
Lyndon B. Johnson Space Center (formerly the Manned Spacecraft Center). These 
specifications, based on manned spacecraft experience to date, cover the basic consid- 
erations, criteria, and parameters of benefit to a displays and controls systems 
designer. 


Lyndon B. Johnson Space Center 

National Aeronautics and Space Administration 
Houston, Texas, October 9, 1974 
924-23-65-01-72 
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